CVE-2026-17622: 
Homebrew vulnerability analysis and mitigation

CVE-2026-17622 is a path traversal vulnerability in IBM Langflow OSS that allows a remote authenticated attacker to obtain sensitive information by bypassing directory restrictions. It affects IBM Langflow OSS versions 1.0.0 through 1.10.2, with version 1.10.3 and later containing the fix. The vulnerability was published on September 4, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, IBM Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). The root cause is insufficient validation of user-supplied pathname input, which fails to properly restrict directory traversal sequences (e.g., ../), allowing an attacker to access files outside the intended restricted directory. Exploitation requires network access and valid (low-privilege) authentication credentials, but no user interaction or elevated privileges beyond that. No public proof-of-concept code has been identified at this time (GitHub Advisory, IBM Advisory).

Successful exploitation allows an authenticated remote attacker to read sensitive files and data outside the intended restricted directories, resulting in a high confidentiality impact. There is no integrity or availability impact associated with this vulnerability. The primary risk is unauthorized disclosure of sensitive server-side files, which could include configuration files, credentials, or other restricted data that may facilitate further attacks (GitHub Advisory, IBM Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The NVD SSVC assessment classifies exploitation as "none" and the technical impact as "partial." The EPSS score is approximately 0.475% (40th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, IBM Advisory).

IBM has released a patch addressing this vulnerability; users should upgrade IBM Langflow OSS to version 1.10.3 or later. As an immediate workaround, restrict network access to Langflow OSS instances and enforce least-privilege authentication to limit exposure. Administrators should also review access logs for evidence of unauthorized file access attempts targeting directory traversal patterns (IBM Advisory, GitHub Advisory).